How to stop ATP clicking links in Phishing simulation emails

Question

I have logged in to Microsoft Defender for O365 and configured the Phishing Simulation tab under Email & collaboration > Policies & rules > Threat policies > Advanced delivery.

But something ATP wise is still clicking the links in my phishing simulation emails and ruining the test results.

Is there an audit log somewhere to show me decisions made processing my email and why it did/didn't meet the phishing simulation rules ?

Answer 1

@DOdmin

Kindly validate the following in SafeLinks URL policy:

If you're using the Built-in protection preset security policy or your custom Safe Links policies have the setting Do not rewrite URLs, do checks via SafeLinks API only enabled, time of click protection doesn't treat phishing simulation links in email as threats in Outlook on the web, Outlook for iOS and Android, Outlook for Windows v16.0.15317.10000 or later, and Outlook for Mac v16.74.23061100 or later. If you're using older versions of Outlook, consider disabling the Do not rewrite URLs, do checks via SafeLinks API only setting in custom Safe Links policies.

Adding phishing simulation URLs to the Do not rewrite the following URLs in email section in Safe Links policies might result in unwanted alerts for URL clicks. Phishing simulation URLs in email messages are automatically allowed both during mail flow and at time of click.

Please "Accept the answer (Yes)" and "share your feedback ". This will help us and others in the community as well.

Thanks,

Akshay Kaushik